Is it possible to talk to a different subnet through another device?

Question

I am trying to adjust the networking on a system so that two subnets can talk to each (ping) other via a device. Setup looks as follows:

          (192.168.1.128)  (172.16.248.223)
Router <------> PC <---------> Device 1 <--------> Device 2
          (172.16.248.248)    (10.0.1.1)          (10.0.1.2)

PC has a DNS Proxy with gateway 172.16.248.254. PC shares its internet to Device 1, and Device 1 shares the internet with Device 2. This is achieved with IP routing, but PC can not ping Device 2. That is also required for my setup. Devices share their internet using USB (cdc_ncm driver).

Routes are as follows:

On PC:

default via 192.168.1.1 dev eno1  proto static  metric 100 
10.0.1.0/24 via 172.16.248.248 dev usb0 
172.16.248.0/24 dev usb0  proto kernel  scope link  src 172.16.248.248 
192.168.1.0/24 dev eno1  proto kernel  scope link  src 192.168.1.128  metric 100
192.168.1.0/24 dev eno1  proto kernel  scope link  src 192.168.1.128  metric 202

On Device 1:

default via 172.16.248.254 dev eth1 
10.0.1.0/24 dev usb1 proto kernel scope link src 10.0.1.1 
172.16.248.0/24 dev eth1 proto kernel scope link src 172.16.248.223

On Device 2:

default via 10.0.1.1 dev usb0 
10.0.1.0/24 dev usb0 proto kernel scope link src 10.0.1.2 
172.16.248.0/24 via 10.0.1.1 dev usb0

Additionaly, usb0 interface on Device 1 has a macvlan interface eth1. While internet connectivity works in this setup, PC can not ping Device 2. However, PC can ping Device 1 and Device 1 can ping Device 2.

To try out things, I have flushed iptables on all devices. I will consider it after I achieve such a connectivity.

Is it possible to make it so that PC can ping Device 2? What am I missing here?

EDIT: All devices already have IP routing enabled. Allow me to rephrase the question to avoid confusion. I want to connect three devices using their physical interfaces (USB). I want all to have internet connection shared from PC, and I want that all devices are able to ping each other. I want have the following:

Device 2 having different subnet does not matter, but without it, internet connection does not work. I need suggestions to achieve this. I have no routers except for the one sharing internet to PC.

Answer 1

Careful with the term "share their internet", usually this involves some kind of NAT (network address translation). I'll assume this is not the case for your setup.

You mention a DNS proxy with 172.16.248.254, but it's not clear how it is connected to the network. I'll assume a network diagram like this (please correct if my interpretation is wrong):

         192.168.1.0/24     172.16.248.0/24         10.0.1.0/24
              |                    |                    |
Router        |                    |                    |
192.168.1.1 --|   172.16.248.248 --|-- 172.16.248.223   |
              |        PC          |       Device 1     |
              |-- 192.168.1.128    |         10.0.1.1 --|   
              |                    |                    |-- 10.0.1.2
              |   172.16.248.254 --|                    |   Device 2
              |      DNS proxy     |                    |
              |                    |                    |

(It's good practice to organize the diagram around subnets). In particular the DNS proxy is not connected to the Router.

This means you need the following routes:

On PC:

default via 192.168.1.1 dev eno1 
10.0.1.0/24 via 172.16.248.233 dev usb0     # NOT .248 !!
172.16.248.0/24 dev usb0
192.168.1.0/24 dev eno1

On Device 1:

default via 172.16.248.248 dev eth1        # NOT .254 !! 
10.0.1.0/24 dev usb1
172.16.248.0/24 dev eth1

On Device 2:

default via 10.0.1.1 dev usb0 
10.0.1.0/24 dev usb0

You'll also need to enable IP forwarding both on PC and on Device 1 (via echo 1 > /proc/sys/net/ipv4/ip_forward as root, can be made permanent with sysctl etc., google).

I'll ignore the problem with the macvlan for the moment, the first step is to get the routing to work.

With this setup, you should be able to ping between PC, Device 1, and Device 2 in any direction. Test this. To debug, run tcpdump -ni usb0 etc. in a new xterm on all interesting interfaces (so four of those on all three devices). Then you can see where your packets disappear if something is not working. ip route get 1.2.3.4 can also be helpful to find out where the kernel thinks the routing for 1.2.3.4 should go.